@agfpd/iapeer 0.4.25 → 0.4.27

package/README.md

@@ -1,6 +1,6 @@
 # iapeer
 
-**The foundation for a team of AI agents on one machine.**
+**Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.**
 
 [![CI](https://github.com/agfpd/iapeer/actions/workflows/ci.yml/badge.svg)](https://github.com/agfpd/iapeer/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@agfpd/iapeer)](https://www.npmjs.com/package/@agfpd/iapeer)
@@ -32,7 +32,7 @@ recipient peer             — asleep? the daemon wakes it and delivers on wake
 ## What makes it different
 
 - **Real interactive CLI sessions, not headless one-shots.** Each AI peer is a full Claude Code or Codex CLI session, not a disposable `claude -p` / `codex exec` call.
-- **Warm-on-demand lifecycle.** A live session answers fast; after about an hour idle the daemon closes it; the next message brings it back with its context resumed. The message flow drives the lifecycle, not a human's presence.
+- **Warm on demand, always reachable.** A live session answers fast; when it goes idle the daemon parks it and brings it back — context resumed — on the next message. Availability never depends on a human keeping the session open. [Lifecycle and daemon](docs/04-lifecycle-and-daemon.md).
 - **One identity across runtimes, with one memory.** A peer's `personality` is decoupled from its runtime: the same peer runs on Claude or Codex, switched with a command. By default (set up by `iapeer onboard`) it carries one shared memory (iapeer-memory) keyed to the personality, not the runtime — one personality, one memory, whatever runtime it runs on.
 - **Heterogeneous peers, one protocol.** AI agents, humans (Telegram), and services (timer = cron, watcher = event) are all first-class, addressed the same way over an always-on MCP daemon that exposes exactly one tool, `send_to_peer`.
 
@@ -58,16 +58,22 @@ iapeer onboard
 
 Either path runs `onboard` interactively: it surfaces the security checks (runtime sign-in, macOS Full Disk Access) and asks before installing the memory provider — nothing is auto-approved behind your back. You can read [`install.sh`](./install.sh) before running it, or preview every step with `IAPEER_INSTALL_DRYRUN=1`.
 
-**Then create your first agent and talk to it:**
+**Then create your agents and put them in touch.** A Claude peer and a Codex peer talk as equals — create one on each runtime:
 
 ```sh
-# create your first agent
-iapeer create assistant --runtime claude
+# create two peers, one per runtime
+iapeer create architect --runtime claude
+iapeer create implementer --runtime codex
 
-# talk to it live in your terminal — detach with Ctrl-] (or just close it; the agent keeps running)
-iapeer attach assistant
+# message one from your terminal
+iapeer send implementer --message "Draft the parser API; the architect will review."
+
+# or join a peer's live session — detach with Ctrl-] (or just close it; the agent keeps running)
+iapeer attach architect
 ```
 
+Inside a peer's own session the agent reaches others with `send_to_peer(<name>, <text>)`; `iapeer send` is the terminal equivalent.
+
 **Already have a project folder?** In step 3, use `init` instead of `create`: `cd` into the project and register that folder itself as a peer.
 
 ```sh
@@ -79,11 +85,11 @@ The peer's name is the folder name, normalized (`myagent`). `create` sets up a f
 
 Two ways to work with an agent locally in your terminal:
 
-- **Join its live session** — `iapeer attach assistant`. The daemon wakes the peer first if it is asleep. Detach with `Ctrl-]` — or just close the terminal — and the session keeps running in the background; reattach with `iapeer attach` whenever you need it.
+- **Join its live session** — `iapeer attach architect`. The daemon wakes the peer first if it is asleep. Detach with `Ctrl-]` — or just close the terminal — and the session keeps running in the background; reattach with `iapeer attach` whenever you need it.
 - **Open a fresh session in the peer's folder** — go to the peer's directory and launch its runtime:
 
   ```sh
-  cd ~/.iapeer/peers/assistant
+  cd ~/.iapeer/peers/architect
   iapeer claude
   ```
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.25",
-  "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
+  "version": "0.4.27",
+  "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",
   "homepage": "https://github.com/agfpd/iapeer#readme",
@@ -13,12 +13,18 @@
     "url": "https://github.com/agfpd/iapeer/issues"
   },
   "keywords": [
-    "multi-agent",
-    "agents",
+    "claude-code",
+    "codex-cli",
+    "codex",
     "mcp",
-    "ipc",
-    "launchd",
-    "bun"
+    "shared-memory",
+    "peer-to-peer",
+    "background-agents",
+    "ai-agents",
+    "multi-agent",
+    "telegram",
+    "macos",
+    "launchd"
   ],
   "type": "module",
   "bin": {

package/src/daemon/index.ts

@@ -353,7 +353,7 @@ export interface StartDaemonOptions extends StorageOptions {
    * owns fleet supervision (idle-reap / zombie-sweep) instead of launchd. The
    * caller wires `tick: () => superviseTick(cfg)` (H4-guarded inside).
    */
-  supervise?: { intervalMs: number; tick: () => void | Promise<void> }
+  supervise?: { intervalMs: number; tick: () => void | Promise<void>; onError?: (err: unknown) => void }
   /**
    * Optional bearer token (H8). When set, EVERY request must carry
    * `Authorization: Bearer <token>` or it is rejected 401 BEFORE any MCP dispatch.
@@ -456,12 +456,20 @@ export async function startDaemon(opts: StartDaemonOptions = {}): Promise<Daemon
   // timer regardless of how many listeners are bound).
   let supervisor: ReturnType<typeof setInterval> | undefined
   if (opts.supervise) {
-    const { intervalMs, tick } = opts.supervise
+    const { intervalMs, tick, onError } = opts.supervise
+    // A supervise tick must NEVER crash the daemon — but its error must NOT be SWALLOWED either: a
+    // silently-swallowed throw is a sweep that stops reaping INVISIBLY (no log, no stderr — the class
+    // that made a stuck reaper undiagnosable for hours). Route BOTH an async rejection and a sync throw
+    // to onError (the production main records ev=supervise-error in lifecycle.log); reporting itself
+    // never throws.
+    const report = (err: unknown): void => {
+      try { onError?.(err) } catch { /* a reporter must never crash the daemon */ }
+    }
     supervisor = setInterval(() => {
       try {
-        void Promise.resolve(tick()).catch(() => {})
-      } catch {
-        /* a supervise tick must never crash the daemon */
+        void Promise.resolve(tick()).catch(report)
+      } catch (err) {
+        report(err)
       }
     }, intervalMs)
     supervisor.unref?.()

package/src/daemon/main.ts

@@ -355,6 +355,15 @@ export async function startConfiguredDaemon(opts: ConfiguredDaemonOptions = {}):
         // head). Identities without a queue or with a live session are no-ops.
         await drainAllEphemeralQueues(cfg, { env })
       },
+      // Surface a supervise-tick throw that the daemon timer would otherwise SWALLOW (the class that
+      // hid a stuck reaper for hours): record ev=supervise-error in lifecycle.log, flattened to one
+      // logfmt line. Best-effort — a reporter must never fail the daemon.
+      onError: (err: unknown) => {
+        try {
+          const detail = err instanceof Error ? (err.stack ?? err.message) : String(err)
+          appendLifecycleEvent(cfg.eventLogDir, { ev: 'supervise-error', error: detail.replace(/\s+/g, ' ').slice(0, 600) }, { env })
+        } catch { /* best-effort */ }
+      },
     },
     bearerToken,
     port: opts.port ?? DEFAULT_DAEMON_PORT,

package/src/launch/adapters/claude.ts

@@ -24,6 +24,7 @@ import { homedir } from 'os'
 import { join } from 'path'
 import { readdirSync, realpathSync, statSync } from 'fs'
 import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
+import { lastTimestampedEntryMs } from './transcriptTail.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Boot dialog + ready markers (lifecycle claudeBootDialog / claudeInputReady)
@@ -280,6 +281,33 @@ export const claudeAdapter: RuntimeAdapter = {
     return newest > 0 ? newest : null
   },
 
+  /**
+   * IDLE-accounting signal: the content-timestamp of the last meaningful entry in the ACTIVE transcript
+   * (newest .jsonl by file mtime), read from its tail. Immune to the file re-save (file-mtime is fresh
+   * but the last ENTRY is not) and to the statusline pane-log tick (the transcript is untouched by a
+   * status redraw). null when the dir is absent/empty or no timestamped entry sits in the tail.
+   */
+  lastTurnMtime(cwd: string): number | null {
+    let entries: string[]
+    try {
+      entries = readdirSync(transcriptDir(cwd))
+    } catch {
+      return null
+    }
+    let best = { path: '', mt: 0 }
+    for (const name of entries) {
+      if (!name.endsWith('.jsonl')) continue
+      try {
+        const path = join(transcriptDir(cwd), name)
+        const mt = statSync(path).mtimeMs
+        if (mt > best.mt) best = { path, mt }
+      } catch {
+        /* race */
+      }
+    }
+    return best.path ? lastTimestampedEntryMs(best.path) : null
+  },
+
   /**
    * Resume preflight (fail-loud — never a silent fresh fallback): resolve the
    * newest transcript uuid for cwd via the claude-slug dir scan (lifecycle.

package/src/launch/adapters/codex.ts

@@ -38,6 +38,7 @@
 import { homedir } from 'os'
 import { join } from 'path'
 import { readFileSync, readdirSync, realpathSync, statSync } from 'fs'
+import { lastTimestampedEntryMs } from './transcriptTail.ts'
 import type { ControlCommand, ControlPlan, LaunchAdapterConfig, LaunchSpec, RuntimeAdapter } from '../types.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -114,9 +115,16 @@ function canonicalPath(p: string): string {
  * (the model produced its first turn); idle accounting reads the same proxy.
  */
 function newestCodexSessionMtime(cwd: string): number | null {
+  return newestCodexSession(cwd)?.mt ?? null
+}
+
+/** The newest ~/.codex/sessions/**\/*.jsonl whose recorded session cwd realpath-matches `cwd`, as
+ *  {path, mt}, or null when none. Shared by newestActivityMtime (file-mtime) and lastTurnMtime (needs
+ *  the PATH to read the tail). Codex nests its session logs in a date tree, so the scan recurses. */
+function newestCodexSession(cwd: string): { path: string; mt: number } | null {
   const root = join(homedir(), '.codex', 'sessions')
   const target = canonicalPath(cwd)
-  let newest = 0
+  let best = { path: '', mt: 0 }
   function visit(dir: string): void {
     let entries
     try {
@@ -134,14 +142,14 @@ function newestCodexSessionMtime(cwd: string): number | null {
       if (canonicalPath(codexSessionCwd(path) ?? '') !== target) continue
       try {
         const mt = statSync(path).mtimeMs
-        if (mt > newest) newest = mt
+        if (mt > best.mt) best = { path, mt }
       } catch {
         /* race — entry vanished between readdir and stat */
       }
     }
   }
   visit(root)
-  return newest > 0 ? newest : null
+  return best.path ? best : null
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -259,6 +267,17 @@ export const codexAdapter: RuntimeAdapter = {
     return newestCodexSessionMtime(cwd)
   },
 
+  /**
+   * IDLE-accounting signal: the content-timestamp of the last meaningful entry in the active codex
+   * session jsonl (newest cwd-matching file), read from its tail. codex entries (event_msg /
+   * response_item) carry a top-level `timestamp`, so this reflects real turn activity — immune to a
+   * file re-save and to a statusline pane-log tick. null when no cwd-matching session / no timestamp.
+   */
+  lastTurnMtime(cwd: string): number | null {
+    const s = newestCodexSession(cwd)
+    return s ? lastTimestampedEntryMs(s.path) : null
+  },
+
   /**
    * Resume preflight (fail-loud — never a silent fresh fallback). Codex resumes
    * via 'resume --last' with NO ref: it matches the newest session for cwd

package/src/launch/adapters/notifier.ts

@@ -68,6 +68,10 @@ export const notifierAdapter: RuntimeAdapter = {
     return null
   },
 
+  lastTurnMtime(_cwd: string): number | null {
+    return null // router — no transcript
+  },
+
   /** Nothing to resume: a router does not replay a transcript. */
   resolveResume(_cwd: string): { ok: boolean; ref?: string; reason?: string } {
     return { ok: true }

package/src/launch/adapters/telegram.ts

@@ -98,6 +98,10 @@ export const telegramAdapter: RuntimeAdapter = {
     return null
   },
 
+  lastTurnMtime(_cwd: string): number | null {
+    return null // router — no transcript
+  },
+
   /**
    * Nothing to resume: a router does not replay a transcript, so resume cannot
    * fail-loud the way claude/codex do — there is no prior session ref to resolve

package/src/launch/adapters/transcriptTail.ts

@@ -0,0 +1,64 @@
+// Shared transcript-tail reader for the idle-accounting signal.
+//
+// The RELIABLE "last real turn" time is the content-timestamp of the LAST meaningful transcript entry —
+// NOT the file mtime (a live claude session RE-SAVES its .jsonl without a new entry, so file-mtime is
+// falsely fresh at idle) and NOT the pane-log mtime (a statusline / footer re-render writes pty bytes at
+// idle, so the pane-log is falsely fresh too). The transcript ENTRY stream only advances on actual turn
+// activity (user/assistant/tool/turn_duration for claude; event_msg/response_item for codex), so the
+// last entry that carries a `timestamp` is the true idle signal — immune to both noise sources.
+
+import { openSync, readSync, closeSync, statSync } from 'fs'
+
+/**
+ * Content-timestamp (epoch ms) of the LAST jsonl entry carrying a `timestamp` field, read from the
+ * file's TAIL (cheap — only the last `tailBytes` are read). Metadata records without a `timestamp`
+ * (claude `mode` / `ai-title` / `bridge-session`) are skipped. Returns null when the file is
+ * unreadable or no timestamped entry sits in the tail (the caller then floors at wokeAt). A partial
+ * FIRST line in the tail buffer is harmless: we scan from the END and return on the first complete
+ * timestamped entry, so a truncated leading line is only ever reached (and skipped) when nothing
+ * matched.
+ */
+export function lastTimestampedEntryMs(path: string, tailBytes = 65536): number | null {
+  let fd: number
+  try {
+    fd = openSync(path, 'r')
+  } catch {
+    return null
+  }
+  try {
+    const size = statSync(path).size
+    const start = Math.max(0, size - tailBytes)
+    const len = size - start
+    if (len <= 0) return null
+    const buf = Buffer.allocUnsafe(len)
+    let read = 0
+    while (read < len) {
+      const n = readSync(fd, buf, read, len - read, start + read)
+      if (n <= 0) break
+      read += n
+    }
+    const lines = buf.subarray(0, read).toString('utf8').split(/\r?\n/)
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i].trim()
+      if (!line) continue
+      let obj: unknown
+      try {
+        obj = JSON.parse(line)
+      } catch {
+        continue // partial leading line / non-json → skip
+      }
+      const ts = (obj as { timestamp?: unknown })?.timestamp
+      if (typeof ts === 'string') {
+        const ms = Date.parse(ts)
+        if (!Number.isNaN(ms)) return ms
+      } else if (typeof ts === 'number' && Number.isFinite(ts)) {
+        return ts
+      }
+    }
+    return null
+  } catch {
+    return null
+  } finally {
+    closeSync(fd)
+  }
+}

package/src/launch/adapters/voicetalk.ts

@@ -81,6 +81,10 @@ export const voicetalkAdapter: RuntimeAdapter = {
     return null
   },
 
+  lastTurnMtime(_cwd: string): number | null {
+    return null // router — no transcript
+  },
+
   /** Nothing to resume: a router does not replay a transcript, so resume cannot
    *  fail-loud the way claude/codex do. Always {ok:true}. */
   resolveResume(_cwd: string): { ok: boolean; ref?: string; reason?: string } {

package/src/launch/types.ts

@@ -263,10 +263,17 @@ export interface RuntimeAdapter {
    *  AND startup dialogs gone). Router runtimes return true (no input surface). */
   isInputReady(pane: string): boolean
 
-  /** Newest activity-proxy mtime for the ready-gate AND idle accounting:
-   *  claude transcript / codex session jsonl mtime; null for a router (no proxy). */
+  /** Newest activity-proxy FILE mtime — used by the READY-GATE (it waits for ANY transcript write past
+   *  baseline = "the model produced its first turn"). NOT for idle accounting: a live session re-saves
+   *  this file without a new entry, so it is falsely fresh at idle. null for a router (no proxy). */
   newestActivityMtime(cwd: string): number | null
 
+  /** Content-timestamp (epoch ms) of the LAST meaningful transcript ENTRY — the reliable IDLE-accounting
+   *  signal. Unlike newestActivityMtime (file mtime, re-touched at idle) and the pane-log mtime (a
+   *  statusline re-render ticks it at idle), the entry stream only advances on real turn activity.
+   *  superviseTick uses THIS for idle/quiet age. null for a router (no transcript). */
+  lastTurnMtime(cwd: string): number | null
+
   /** Resume preflight — validate a resume request fail-loud (never silent fresh).
    *  Returns the resolved ref (claude uuid) or ok:false with a reason. */
   resolveResume(cwd: string): { ok: boolean; ref?: string; reason?: string }

package/src/lifecycle/index.ts

@@ -344,21 +344,6 @@ export function clearEphemeralArmed(cfg: LifecycleConfig, identity: string): voi
   }
 }
 
-/** mtime (ms) of a hosted session's pane-log (`<logDir>/<identity>.log`) — the RAW TUI
- *  render byte-stream the supervisor appends for the session's whole life. It advances
- *  ~1s while the TUI is rendering a turn (the "esc to interrupt" elapsed counter ticks
- *  during BOTH model generation AND a tool run) and goes quiet at the prompt. So it is
- *  the truest active-turn liveness signal — the SAME mtime telegram-runtime reads for its
- *  typing/activity indicator — and unlike the transcript proxy it does NOT go quiet during
- *  a long model generation (no JSONL write until the message completes). null if absent. */
-function paneLogMtimeMs(cfg: LifecycleConfig, identity: string): number | null {
-  try {
-    return statSync(join(cfg.logDir, `${identity}.log`)).mtimeMs
-  } catch {
-    return null
-  }
-}
-
 function deathsPath(cfg: LifecycleConfig, identity: string): string {
   return join(cfg.stateDir, `${identity}.deaths`)
 }
@@ -1144,7 +1129,7 @@ export function killSession(_sock: string, identity: string): void {
 
 export interface SuperviseOutcome {
   identity: string
-  action: 'reaped-idle' | 'reaped-gone' | 'reaped-ephemeral' | 'skipped-launchd' | 'skipped-stopped' | 'alive' | 'needs-eager-fresh'
+  action: 'reaped-idle' | 'reaped-gone' | 'reaped-ephemeral' | 'skipped-launchd' | 'skipped-stopped' | 'alive' | 'needs-eager-fresh' | 'skipped-error'
   reason?: string
   /** For 'needs-eager-fresh': the peer to EAGERLY re-launch fresh (its session died
    *  carrying a .new-eager mark). The daemon timer drives the async relaunch.
@@ -1157,23 +1142,176 @@ export interface SuperviseOutcome {
 export interface SuperviseDeps {
   env?: NodeJS.ProcessEnv
   nowMs?: number
-  /** Activity proxy seam (default: the runtime adapter's transcript/session mtime). Tests inject a
-   *  controlled value to exercise the idle-age floor without a real transcript on disk. */
-  newestActivityMtime?: (runtime: string, cwd: string) => number | null
-  /** Liveness seam (default: the real `sessionAlive` = pty-host OR tmux-fallback). Tests inject a
-   *  fixed verdict so the idle path is exercised hermetically — no live tmux/pty session needed. */
+  /** IDLE-proxy seam (default: the runtime adapter's `lastTurnMtime` = content-ts of the last meaningful
+   *  transcript entry). This is the RELIABLE idle signal — NOT the transcript FILE mtime (re-saved at
+   *  idle) and NOT the pane-log mtime (a statusline re-render ticks it at idle); both falsely keep an
+   *  idle session young. Tests inject a controlled value to exercise the idle/quiet age hermetically. */
+  lastTurnMtime?: (runtime: string, cwd: string) => number | null
+  /** Liveness seam (default: the real `sessionAlive` = pty-host pid-file check). Tests inject a fixed
+   *  verdict so the idle path is exercised hermetically — no live pty session needed. */
   sessionAlive?: (sock: string, identity: string) => boolean
-  /** Pane-log mtime seam (default: the real pane-log file mtime). Tests inject a controlled value to
-   *  exercise the ephemeral active-turn vs idle distinction without a real pane-log on disk. */
-  paneLogMtime?: (identity: string) => number | null
+}
+
+/** Resolved per-tick context threaded into superviseOnePeer (deps already defaulted by superviseTick). */
+interface SuperviseCtx {
+  cfg: LifecycleConfig
+  env: NodeJS.ProcessEnv
+  nowMs: number
+  lastTurnMt: (runtime: string, cwd: string) => number | null
+  isAlive: (sock: string, identity: string) => boolean
+  verbose: boolean
+  trace: (fields: Record<string, string | number | undefined>) => void
+}
+
+/**
+ * Evaluate ONE daemon-owned session and take its at-most-one reap action, returning the outcome.
+ * Extracted from superviseTick so a throw on a SINGLE peer can be ISOLATED by the caller: a malformed
+ * peer-state must never abort the whole sweep (that is the silent fleet-wide reap-outage class — one bad
+ * peer and NO peer gets reaped, the error swallowed by the daemon's supervise-tick catch). Every branch
+ * returns exactly one outcome; the trace side-effects mirror the prior inline behaviour.
+ */
+function superviseOnePeer(s: SessionState, ctx: SuperviseCtx): SuperviseOutcome {
+  const { cfg, env, nowMs, lastTurnMt, isAlive, verbose, trace } = ctx
+  // H4 — FIRST, before any reap. A launchd-managed peer is read-only.
+  if (isLaunchdManaged(s.personality, env)) {
+    if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4' })
+    return { identity: s.identity, action: 'skipped-launchd' }
+  }
+  const sock = buildSocketPath(s.runtime, s.personality, cfg.sockDir)
+  if (!isAlive(sock, s.identity)) {
+    // A DELIBERATE stop is not a death: the stop verb parks clean
+    // (.stopped + .idle-reaped) and kills the session itself. Catch-up branch for
+    // a stop that raced this tick (or a pre-fix stop): drop the state quietly —
+    // no crash-loop entry, no death class — and ensure the clean-park marker so
+    // the post-`start` wake RESUMES (stop→start must survive ≥ idle-reap).
+    if (isStopped(cfg, s.identity)) {
+      removeSessionState(cfg, s.identity)
+      clearEphemeralArmed(cfg, s.identity)
+      setIdleReaped(cfg, s.identity) // idempotent with the stop verb's own park
+      trace({ identity: s.identity, action: 'skipped-stopped', outcome: 'resume-on-start' })
+      return { identity: s.identity, action: 'skipped-stopped', reason: 'deliberate stop — parked clean, resumes on start' }
+    }
+    // A dead session: record a death for crash-loop accounting, then branch on the
+    // .new-eager mark. This death was NOT daemon-initiated (the daemon only initiates
+    // the idle-reap below) → it died on its own → do NOT write .idle-reaped here.
+    recordDeath(cfg, s.identity, nowMs)
+    removeSessionState(cfg, s.identity)
+    // The .ephemeral-armed mark belongs to THIS (now dead) session — it armed on its
+    // outbound reply. Clear it with the session, so a successor session can never be
+    // quiet-reaped on a stale mark before answering its own task. No-op otherwise.
+    clearEphemeralArmed(cfg, s.identity)
+    // A session that died carrying a .new-eager mark is an owner /new: re-launch
+    // EAGERLY as fresh (not lazily on the next message). The mark is LEFT for the
+    // eager relaunch (processEagerRelaunches) to consume; the daemon timer drives it.
+    if (hasNewEager(cfg, s.identity)) {
+      trace({ identity: s.identity, action: 'needs-eager-fresh', reason: '/new eager mark', outcome: 'eager-fresh' })
+      return {
+        identity: s.identity,
+        action: 'needs-eager-fresh',
+        reason: '/new eager mark — eager fresh re-launch',
+        personality: s.personality,
+        runtime: s.runtime,
+      }
+    }
+    // Crash / self-close: NO marker written, NO eager relaunch — the peer stays
+    // asleep and wakes FRESH lazily on the next message (resolveWakeMode branch 3a).
+    // The death-class tag (classifyGoneSession) makes the two gone-classes
+    // distinguishable in lifecycle.log: `session-gone` (pane died, server alive →
+    // exits.log should have the cause) vs `server-dead` (whole tmux server died →
+    // exits.log structurally empty; this line is the only durable trace).
+    const gone = classifyGoneSession(sock)
+    trace({ identity: s.identity, action: 'reaped-gone', death: gone.death, reason: gone.reason, outcome: 'fresh-next-msg' })
+    return { identity: s.identity, action: 'reaped-gone', reason: gone.reason }
+  }
+  // Idle accounting via the LAST MEANINGFUL TRANSCRIPT ENTRY's content-timestamp (adapter.lastTurnMtime)
+  // — the only RELIABLE idle signal. The two raw mtimes both report FALSE freshness for an idle session:
+  //   • pane-log mtime — a statusline / footer re-render writes pty bytes at idle (the clock/usage/ctx%
+  //     redraw + Claude Code's own update-check/token-counter), so the pane-log ticks at the prompt. The
+  //     0.4.16 invariant "the pane-log goes quiet ONLY at the prompt" was broken by the statusline.
+  //   • transcript FILE mtime — a live claude session RE-SAVES its .jsonl without appending a new entry,
+  //     so the file is fresh while the last real turn was hours ago (the 0.4.16 re-touch).
+  // Both made real peers live idle 3-5h UNREAPED (incident 23.06: perplex/mrwriter/doc). The transcript
+  // ENTRY stream only advances on actual turn activity, so the last timestamped entry is the true last
+  // turn. The launch ready-gate keeps newestActivityMtime (file-mtime advance = "a turn produced
+  // output"). FLOORED at wokeAt: a freshly-woken session that produced no turn yet (lastTurn from a PRIOR
+  // session is old) must not be reaped out from under an attaching op — max(lastTurn, wokeAt) reaps it
+  // idleSecs after the wake, never before. null lastTurn (unreadable / churned out of the tail) → wokeAt
+  // governs (an old wokeAt = woken-long-ago = idle → reaped; a recent wokeAt = just-woken → protected).
+  const ephemeral = isEphemeralPeer(s.cwd)
+  let lt = 0
+  try { lt = lastTurnMt(s.runtime, s.cwd) ?? 0 } catch { /* unreadable → wokeAt floor */ }
+  const mt = Math.max(lt, s.wokeAt)
+  const ageSecs = Math.floor((nowMs - mt) / 1000)
+  // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
+  // daemon routed its outbound reply) is reaped after a QUIET window, checked
+  // BEFORE the idle branch (quiet ≪ idle). Quiet = the pane-log silent for
+  // ephemeralQuietSecs (the reliable render signal above) — a still-rendering turn
+  // keeps it fresh, so the worker finishes its turn first; post-reply housekeeping
+  // (operative-note writes) also advances it.
+  // NOT armed (still mid-task) → the ordinary idle bound below is its only reaper.
+  // Deliberate, policy-driven death: NO .idle-reaped (an ephemeral peer never resumes)
+  // and NO recordDeath (the crash-loop ring counts faults, not policy reaps).
+  if (ephemeral && hasEphemeralArmed(cfg, s.identity) && ageSecs > cfg.ephemeralQuietSecs) {
+    killSession(sock, s.identity)
+    clearEphemeralArmed(cfg, s.identity)
+    removeSessionState(cfg, s.identity)
+    trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-done' })
+    return {
+      identity: s.identity,
+      action: 'reaped-ephemeral',
+      reason: `armed, quiet ${ageSecs}s`,
+      personality: s.personality,
+      runtime: s.runtime,
+    }
+  }
+  // UNARMED ephemeral idle bound (live case): a worker that ended
+  // SILENTLY (no final outbound → never armed; or its arm was lost to a CLI/
+  // daemon-restart window) used to wait out the FULL generic idleSecs (1 h) —
+  // and the M3 serial drain waits for the session's death, so ONE silent worker
+  // stalled its whole conveyor. This bound is the defense-in-depth backstop:
+  // ≫ the legitimate silent-tool case (sleep-180), ≪ idleSecs. The ШТАТНЫЙ
+  // silent-finish path is `iapeer self-done` (arm without waking anyone —
+  // the invariant «нет пустых пробуждений» stays intact); this branch only
+  // bounds the damage when a worker does neither. Policy reap: NO .idle-reaped
+  // (ephemeral never resumes), NO recordDeath (the ring counts faults). The pane-log
+  // fold-in above also covers this branch: a STILL-WORKING unarmed worker (a silent
+  // tool, no reply yet) keeps the pane-log fresh via the TUI render, so it is no longer
+  // reaped mid-task — only a genuinely idle/wedged unarmed session crosses this bound.
+  if (ephemeral && ageSecs > cfg.ephemeralUnarmedIdleSecs) {
+    killSession(sock, s.identity)
+    clearEphemeralArmed(cfg, s.identity)
+    removeSessionState(cfg, s.identity)
+    trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-unarmed-bound' })
+    return {
+      identity: s.identity,
+      action: 'reaped-ephemeral',
+      reason: `unarmed idle ${ageSecs}s (silent-finish backstop; штатный путь — iapeer self-done)`,
+      personality: s.personality,
+      runtime: s.runtime,
+    }
+  }
+  if (ageSecs > cfg.idleSecs) {
+    // THE ONLY place .idle-reaped is written: this is the one death the daemon
+    // INITIATES. Its presence on the next wake = the session was parked cleanly =
+    // RESUME-eligible (resolveWakeMode branch 3b). A crash/self-close (the dead
+    // branch above) never writes it → that wakes FRESH (branch 3a).
+    killSession(sock, s.identity)
+    setIdleReaped(cfg, s.identity)
+    removeSessionState(cfg, s.identity)
+    trace({ identity: s.identity, action: 'reaped-idle', age: `${ageSecs}s`, outcome: 'resume-eligible' })
+    return { identity: s.identity, action: 'reaped-idle', reason: `idle ${ageSecs}s` }
+  }
+  // ALIVE and not idle. (pty-only: no tmux server-death canary — a hosted death is recorded by the
+  // supervisor's exits.log and classified by classifyGoneSession on the next sweep.)
+  if (verbose) trace({ identity: s.identity, action: 'alive', age: `${ageSecs}s` })
+  return { identity: s.identity, action: 'alive' }
 }
 
 export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): SuperviseOutcome[] {
   const env = deps.env ?? process.env
   const nowMs = deps.nowMs ?? Date.now()
-  const activityMtime = deps.newestActivityMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).newestActivityMtime(c))
+  const lastTurnMt = deps.lastTurnMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).lastTurnMtime(c))
   const isAlive = deps.sessionAlive ?? sessionAlive
-  const paneLogMt = deps.paneLogMtime ?? ((identity: string) => paneLogMtimeMs(cfg, identity))
   const verbose = superviseLogVerbose(env)
   // Pane-log volume cap (launch/cmdlog.ts capPaneLogs): the per-identity pane-log
   // (<logDir>/<identity>.log) is the RAW TUI byte stream pipe-pane/the supervisor
@@ -1190,160 +1328,18 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const trace = (fields: Record<string, string | number | undefined>): void =>
     appendLifecycleEvent(cfg.eventLogDir, { ev: 'supervise', ...fields }, { env, nowMs })
   const out: SuperviseOutcome[] = []
+  const ctx: SuperviseCtx = { cfg, env, nowMs, lastTurnMt, isAlive, verbose, trace }
   for (const s of readSessionStates(cfg)) {
-    // H4 — FIRST, before any reap. A launchd-managed peer is read-only.
-    if (isLaunchdManaged(s.personality, env)) {
-      out.push({ identity: s.identity, action: 'skipped-launchd' })
-      if (verbose) trace({ identity: s.identity, action: 'skipped-launchd', outcome: 'read-only-h4' })
-      continue
-    }
-    const sock = buildSocketPath(s.runtime, s.personality, cfg.sockDir)
-    if (!isAlive(sock, s.identity)) {
-      // A DELIBERATE stop is not a death: the stop verb parks clean
-      // (.stopped + .idle-reaped) and kills the session itself. Catch-up branch for
-      // a stop that raced this tick (or a pre-fix stop): drop the state quietly —
-      // no crash-loop entry, no death class — and ensure the clean-park marker so
-      // the post-`start` wake RESUMES (stop→start must survive ≥ idle-reap).
-      if (isStopped(cfg, s.identity)) {
-        removeSessionState(cfg, s.identity)
-        clearEphemeralArmed(cfg, s.identity)
-        setIdleReaped(cfg, s.identity) // idempotent with the stop verb's own park
-        out.push({ identity: s.identity, action: 'skipped-stopped', reason: 'deliberate stop — parked clean, resumes on start' })
-        trace({ identity: s.identity, action: 'skipped-stopped', outcome: 'resume-on-start' })
-        continue
-      }
-      // A dead session: record a death for crash-loop accounting, then branch on the
-      // .new-eager mark. This death was NOT daemon-initiated (the daemon only initiates
-      // the idle-reap below) → it died on its own → do NOT write .idle-reaped here.
-      recordDeath(cfg, s.identity, nowMs)
-      removeSessionState(cfg, s.identity)
-      // The .ephemeral-armed mark belongs to THIS (now dead) session — it armed on its
-      // outbound reply. Clear it with the session, so a successor session can never be
-      // quiet-reaped on a stale mark before answering its own task. No-op otherwise.
-      clearEphemeralArmed(cfg, s.identity)
-      // A session that died carrying a .new-eager mark is an owner /new: re-launch
-      // EAGERLY as fresh (not lazily on the next message). The mark is LEFT for the
-      // eager relaunch (processEagerRelaunches) to consume; the daemon timer drives it.
-      if (hasNewEager(cfg, s.identity)) {
-        out.push({
-          identity: s.identity,
-          action: 'needs-eager-fresh',
-          reason: '/new eager mark — eager fresh re-launch',
-          personality: s.personality,
-          runtime: s.runtime,
-        })
-        trace({ identity: s.identity, action: 'needs-eager-fresh', reason: '/new eager mark', outcome: 'eager-fresh' })
-        continue
-      }
-      // Crash / self-close: NO marker written, NO eager relaunch — the peer stays
-      // asleep and wakes FRESH lazily on the next message (resolveWakeMode branch 3a).
-      // The death-class tag (classifyGoneSession) makes the two gone-classes
-      // distinguishable in lifecycle.log: `session-gone` (pane died, server alive →
-      // exits.log should have the cause) vs `server-dead` (whole tmux server died →
-      // exits.log structurally empty; this line is the only durable trace).
-      const gone = classifyGoneSession(sock)
-      out.push({ identity: s.identity, action: 'reaped-gone', reason: gone.reason })
-      trace({ identity: s.identity, action: 'reaped-gone', death: gone.death, reason: gone.reason, outcome: 'fresh-next-msg' })
-      continue
-    }
-    // Idle accounting via the PANE-LOG (TUI render-stream) mtime — the RELIABLE idle
-    // signal: it advances ~1s while the TUI renders ANY turn (model generation OR a tool
-    // run — the "esc to interrupt" elapsed counter ticks) and goes quiet ONLY at the
-    // prompt. NOT the transcript file mtime: a live claude session RE-TOUCHES its session
-    // .jsonl ~every 30-45min WITHOUT a real turn (a system/bridge re-save), so the
-    // transcript proxy is perpetually < idleSecs and a claude peer NEVER idle-reaps — the
-    // fleet-reap incident: a warm claude pile, last real turn hours ago, never reaped;
-    // codex's session file is NOT re-touched, so codex reaps (the claude-vs-codex split).
-    // The transcript stays the launch ready-gate's signal (it needs "a real turn produced
-    // output"); only this idle proxy moves to the pane-log. FLOORED at wokeAt: a session
-    // cannot be idle longer than it has been awake (a wake that produced no turn →
-    // mt=wokeAt → reaped idleSecs after the wake, never out from under an attaching op).
-    const ephemeral = isEphemeralPeer(s.cwd)
-    const plMt = paneLogMt(s.identity)
-    let mt: number
-    if (plMt !== null) {
-      mt = Math.max(plMt, s.wokeAt)
-    } else {
-      // Pane-log MISSING (a legacy pre-pane-log supervisor) → fall back to the transcript
-      // proxy, NEVER to wokeAt-as-activity: a wokeAt-only age would read an ACTIVE legacy
-      // session's idle from its hours-old wokeAt and reap it MID-WORK. The transcript is
-      // false-fresh at idle (so an IDLE legacy peer lingers warm until its next respawn
-      // earns a pane-log — bounded, self-heals), but an ACTIVE legacy peer keeps a
-      // genuinely-fresh transcript and is correctly protected. Safe direction preserved.
-      let tx = 0
-      try { tx = activityMtime(s.runtime, s.cwd) ?? 0 } catch { /* no adapter → wokeAt */ }
-      mt = Math.max(tx, s.wokeAt)
-    }
-    const ageSecs = Math.floor((nowMs - mt) / 1000)
-    // wake_policy:ephemeral M2 — die-after-reply: an ARMED ephemeral session (the
-    // daemon routed its outbound reply) is reaped after a QUIET window, checked
-    // BEFORE the idle branch (quiet ≪ idle). Quiet = the pane-log silent for
-    // ephemeralQuietSecs (the reliable render signal above) — a still-rendering turn
-    // keeps it fresh, so the worker finishes its turn first; post-reply housekeeping
-    // (operative-note writes) also advances it.
-    // NOT armed (still mid-task) → the ordinary idle bound below is its only reaper.
-    // Deliberate, policy-driven death: NO .idle-reaped (an ephemeral peer never resumes)
-    // and NO recordDeath (the crash-loop ring counts faults, not policy reaps).
-    if (ephemeral && hasEphemeralArmed(cfg, s.identity) && ageSecs > cfg.ephemeralQuietSecs) {
-      killSession(sock, s.identity)
-      clearEphemeralArmed(cfg, s.identity)
-      removeSessionState(cfg, s.identity)
-      out.push({
-        identity: s.identity,
-        action: 'reaped-ephemeral',
-        reason: `armed, quiet ${ageSecs}s`,
-        personality: s.personality,
-        runtime: s.runtime,
-      })
-      trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-done' })
-      continue
-    }
-    // UNARMED ephemeral idle bound (live case): a worker that ended
-    // SILENTLY (no final outbound → never armed; or its arm was lost to a CLI/
-    // daemon-restart window) used to wait out the FULL generic idleSecs (1 h) —
-    // and the M3 serial drain waits for the session's death, so ONE silent worker
-    // stalled its whole conveyor. This bound is the defense-in-depth backstop:
-    // ≫ the legitimate silent-tool case (sleep-180), ≪ idleSecs. The ШТАТНЫЙ
-    // silent-finish path is `iapeer self-done` (arm without waking anyone —
-    // the invariant «нет пустых пробуждений» stays intact); this branch only
-    // bounds the damage when a worker does neither. Policy reap: NO .idle-reaped
-    // (ephemeral never resumes), NO recordDeath (the ring counts faults). The pane-log
-    // fold-in above also covers this branch: a STILL-WORKING unarmed worker (a silent
-    // tool, no reply yet) keeps the pane-log fresh via the TUI render, so it is no longer
-    // reaped mid-task — only a genuinely idle/wedged unarmed session crosses this bound.
-    if (ephemeral && ageSecs > cfg.ephemeralUnarmedIdleSecs) {
-      killSession(sock, s.identity)
-      clearEphemeralArmed(cfg, s.identity)
-      removeSessionState(cfg, s.identity)
-      out.push({
-        identity: s.identity,
-        action: 'reaped-ephemeral',
-        reason: `unarmed idle ${ageSecs}s (silent-finish backstop; штатный путь — iapeer self-done)`,
-        personality: s.personality,
-        runtime: s.runtime,
-      })
-      trace({ identity: s.identity, action: 'reaped-ephemeral', age: `${ageSecs}s`, outcome: 'ephemeral-unarmed-bound' })
-      continue
-    }
-    if (ageSecs > cfg.idleSecs) {
-      // THE ONLY place .idle-reaped is written: this is the one death the daemon
-      // INITIATES. Its presence on the next wake = the session was parked cleanly =
-      // RESUME-eligible (resolveWakeMode branch 3b). A crash/self-close (the dead
-      // branch above) never writes it → that wakes FRESH (branch 3a).
-      killSession(sock, s.identity)
-      setIdleReaped(cfg, s.identity)
-      removeSessionState(cfg, s.identity)
-      out.push({ identity: s.identity, action: 'reaped-idle', reason: `idle ${ageSecs}s` })
-      trace({ identity: s.identity, action: 'reaped-idle', age: `${ageSecs}s`, outcome: 'resume-eligible' })
-    } else {
-      // Server-death canary retrofit (canary.ts): ensure a canary is watching
-      // every ALIVE daemon-owned server — covers a fleet launched by older code
-      // within one tick of a deploy, no session restarts. Idempotent (pgrep on
-      // the per-identity wait-for channel), best-effort, pure observability.
-      // pty-only: no tmux server-death canary — a hosted death is recorded by the supervisor's
-      // exits.log (host=supervisor, resilience-b), classified by classifyGoneSession on the next sweep.
-      out.push({ identity: s.identity, action: 'alive' })
-      if (verbose) trace({ identity: s.identity, action: 'alive', age: `${ageSecs}s` })
+    // Per-peer ISOLATION: a throw while evaluating ONE peer must NOT abort the whole sweep — that is
+    // the silent fleet-wide reap-outage class (one malformed peer-state and NO peer gets reaped, the
+    // error swallowed by the daemon's supervise-tick catch). Catch it, log it loudly to lifecycle.log,
+    // and continue to the next peer — the rest of the fleet is still swept.
+    try {
+      out.push(superviseOnePeer(s, ctx))
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e)
+      out.push({ identity: s.identity, action: 'skipped-error', reason })
+      trace({ identity: s.identity, action: 'skipped-error', reason, outcome: 'peer-error-isolated' })
     }
   }
   return out

package/src/transport/index.ts

@@ -152,28 +152,25 @@ export function resolvePeerDeliveryTarget(
   return resolveDeliveryTarget({ personality })
 }
 
-// Ф-B liveness: how long to keep polling the activity proxy for a transcript
-// advance when the submit did NOT clear the input (a busy session whose input row
-// is not rendered). Env-tunable for LIVE calibration (busy/idle/cold). Conservative
-// default — long enough that a busy-but-alive session reliably shows an advance,
-// short enough that a genuinely dead session is failed promptly. Prefer a false-
-// FAIL (sender retries) over a false-OK (silent loss, which the contract forbids).
+// Confirm poll interval — how often deliverViaHost re-reads the transcript for a NEW record carrying
+// our envelope while waiting out the grace.
 const LIVENESS_POLL_MS = 100
-function livenessGraceMs(): number {
-  const raw = process.env.IAP_LIVENESS_GRACE_MS
-  const n = raw === undefined ? NaN : Number(raw)
-  return Number.isFinite(n) && n >= 0 ? n : 3000
-}
 
-// Host (spawn-flip Ф0b-2) liveness grace — DECOUPLED from the tmux grace by design. The hosted path
-// has no input-clear fast confirm (no capture-pane), so a transcript advance is its SOLE landed-proof
-// and may need its own calibration. `IAP_HOST_LIVENESS_GRACE_MS` tunes ONLY the hosted path; when
-// unset it falls back to the shared `livenessGraceMs()` — so calibrating hosted NEVER loosens the
-// tmux/fleet grace (a global bump there would be a fleet regression).
-function hostLivenessGraceMs(): number {
+// Confirm grace — how long deliverViaHost polls for a transcript record CARRYING our envelope before
+// declaring a false-FAIL. Per-RUNTIME because the runtimes log an accepted injection at different
+// times: claude writes the queue-operation (busy) / user-turn (idle) record PROMPTLY (sub-second), so
+// a short grace suffices; codex writes its session-jsonl user-input only at model-turn-START (TTFT
+// measured ~4-6s after submit), so it needs a longer window or every codex delivery would false-FAIL
+// before the first write. `IAP_HOST_LIVENESS_GRACE_MS` overrides BOTH (operator calibration; tests set
+// 0 for an immediate deterministic fail). Prefer a false-FAIL (sender retries) over a false-OK (silent
+// loss, which the contract forbids).
+const CONFIRM_GRACE_CLAUDE_MS = 4000
+const CONFIRM_GRACE_CODEX_MS = 8000
+function confirmGraceMs(runtime: string): number {
   const raw = process.env.IAP_HOST_LIVENESS_GRACE_MS
   const n = raw === undefined ? NaN : Number(raw)
-  return Number.isFinite(n) && n >= 0 ? n : livenessGraceMs()
+  if (Number.isFinite(n) && n >= 0) return n
+  return runtime === 'codex' ? CONFIRM_GRACE_CODEX_MS : CONFIRM_GRACE_CLAUDE_MS
 }
 
 // Launchd-revive retry — a MISS on a launchd-managed target the daemon can't wake (H4)
@@ -189,28 +186,31 @@ function launchdReviveGraceMs(): number {
 
 // ─── Warm delivery (pty-only — supervisor socket) ────────────────────────────────────────────────
 
-/** Test seam for `deliverWarm`. Production defaults route on the real supervisor; tests inject a
- *  fake host-deliver + a temp transcript proxy, so the deliver path is covered with no live daemon.
- *  Omitting all fields = pure production behaviour. */
+/** Test seam for `deliverWarm`. Production defaults route on the real supervisor + the real
+ *  message-specific transcript confirm; tests inject a fake host-deliver + a synthetic landed-confirm,
+ *  so the deliver path is covered with no live daemon. Omitting all fields = pure production. */
 export interface WarmDeliverSeam {
   /** Deliver to the hosted session over its socket. Default: the real `deliverHosted` (Ф0a leaf). */
   deliverHosted?: (identity: string, envelope: string) => Promise<DeliverResult>
-  /** Activity proxy for the landed-confirm. Default: the target runtime adapter's transcript mtime. */
-  newestActivityMtime?: (cwd: string) => number | null
-  /** SECOND landed-confirm proxy: the pane-log (TUI render-stream) mtime, keyed by process
-   *  ADDRESS. Default: the real `<root>/logs/lifecycle/<address>.log` mtime. The pane-log ticks
-   *  ~1s as the session renders its working state on submit — for codex it advances ~1s while the
-   *  session-jsonl only advances at model-turn-start (~4-6s, past the grace), so this is the signal
-   *  that gives codex delivery parity. See `deliverViaHost`. */
-  paneLogMtime?: (address: string) => number | null
+  /** MESSAGE-SPECIFIC landed-confirm: did a NEW transcript/session-jsonl record CARRYING this envelope
+   *  appear since the pre-deliver baseline? Default: `transcriptCarriesEnvelope` over a file-size
+   *  baseline captured before the send. A bare mtime bump (the receiver's OWN turn) is NOT a confirm —
+   *  that was the false-OK class this replaces. */
+  confirmLanded?: (envelope: string) => boolean
+  /** Injectable async sleep for the confirm poll (tests). Default: setTimeout — it YIELDS the event
+   *  loop (the grace is up to several seconds for codex, so a sync block would stall the whole router
+   *  daemon for the duration of one delivery). */
+  sleep?: (ms: number) => Promise<void>
 }
 
 /**
  * Warm-deliver `envelope` to a LIVE local target over its supervisor socket (pty-only). Landing is
- * CONFIRMED by a transcript-mtime advance past the pre-deliver baseline, NOT the socket-ack (a flushed
- * CR proves the bytes left us, NOT that the session accepted them; trusting the ack would re-open the
- * silent-loss class the contract forbids). A router (telegram/notifier) has no transcript proxy → it is
- * confirmed by the socket-ack (its liveness is structural via launchd KeepAlive). See `deliverViaHost`.
+ * CONFIRMED MESSAGE-SPECIFICALLY — by a NEW transcript record CARRYING this envelope appearing past the
+ * pre-deliver baseline, NOT the socket-ack (a flushed CR proves the bytes left us, not that the session
+ * accepted them) and NOT a bare mtime advance (the receiver's OWN concurrent turn bumps mtime even when
+ * our paste was swallowed — the false-OK class the contract forbids). A router (telegram/notifier) has
+ * no transcript → confirmed by the socket-ack (liveness is structural via launchd KeepAlive). See
+ * `deliverViaHost`.
  */
 export async function deliverWarm(
   target: DeliveryTarget,
@@ -228,13 +228,10 @@ async function deliverViaHost(
   seam: WarmDeliverSeam,
 ): Promise<Result<void>> {
   const adapter = getAdapter(target.runtime)
-  const mtimeOf = seam.newestActivityMtime ?? ((c: string) => adapter.newestActivityMtime(c))
-  const paneMtimeOf = seam.paneLogMtime ?? ((addr: string) => defaultPaneLogMtime(addr))
-  // Baseline BOTH landed-proxies BEFORE delivery (a paste/CR does not move the transcript — only a
-  // model turn does; the pane-log moves as the session renders), so an advance in EITHER afterwards
-  // proves the session is alive and took our message.
-  const baseline = cwd ? mtimeOf(cwd) ?? 0 : 0
-  const paneBaseline = paneMtimeOf(target.address) ?? 0
+  // Baseline the transcript/session-jsonl file SIZES BEFORE delivery (per-runtime candidate files).
+  // The landed-confirm reads ONLY the bytes appended past this baseline, so a record carrying our
+  // envelope can only be one written in RESPONSE to this delivery — never a pre-existing copy.
+  const baseline = cwd ? compactDoneBaseline(target.runtime, cwd) : null
   const send = seam.deliverHosted ?? deliverHosted
   const sent = await send(target.address, envelope)
   if (!sent.ok) {
@@ -243,45 +240,42 @@ async function deliverViaHost(
         `message NOT delivered`,
     )
   }
-  // Router (telegram/notifier): no transcript proxy (adapter.newestActivityMtime=null) → the
-  // mtime-advance confirm below can NEVER be satisfied and would false-FAIL every router delivery.
-  // Confirm by the socket-ack just obtained — PARITY with deliverViaTmux's router path (C-j success =
-  // delivery-level confirm; a router's liveness is structural via launchd KeepAlive, not a model
-  // turn). See deliverViaTmux router branch (paste-buffer -r + C-j, no transcript confirm) + its
-  // header note "router … liveness is structural".
+  // Router (telegram/notifier): no transcript proxy → confirmed by the socket-ack just obtained. A
+  // router's liveness is structural via launchd KeepAlive (not a model turn), so the ack IS the
+  // delivery-level confirm (parity with the legacy tmux router C-j path).
   if (adapter.kind === 'router') return ok(undefined)
-  // socket-ack ≠ landed. With no activity proxy (direct callers/tests without a cwd) we can only
-  // trust the flushed submit — confirmed-only, mirroring deliverViaTmux's legacy-caller path.
-  if (!cwd) return ok(undefined)
-  // Confirm landing by EITHER of two proxies within the grace:
-  //  (a) transcript/session-jsonl mtime advance — the strong "model wrote a turn" signal. claude
-  //      writes the user turn to its transcript promptly (sub-second); CODEX writes its session
-  //      jsonl only at model-turn-START (gated by TTFT, measured ~4-6s after submit), so on the
-  //      transcript-ONLY confirm every codex delivery STRUCTURALLY false-FAILED (the 3000ms grace
-  //      expires before the first session write — proven in delivery.log).
-  //  (b) PANE-LOG (TUI render-stream) mtime advance — the SAME true active-turn signal the 0.4.16
-  //      idle-reap fix uses: it ticks ~1s as the session renders the working state on submit, so it
-  //      catches codex in ~1s, giving codex delivery parity with claude WITHOUT lengthening the
-  //      (synchronous) grace. NOT a false-OK: an advance proves the session is alive and rendered
-  //      output in response to our just-flushed bytes (a wedged/dead pty renders nothing → no
-  //      advance → correct fail); the bytes are then in the session's input (codex queues input
-  //      during a turn). Prefer a false-FAIL (sender retries) over a false-OK (silent loss).
-  const graceMs = hostLivenessGraceMs()
+  // socket-ack ≠ landed. With no transcript (direct callers/tests without a cwd) we can only trust the
+  // flushed submit — confirmed-only.
+  if (!cwd || !baseline) return ok(undefined)
+  // MESSAGE-SPECIFIC landed-confirm — the false-OK killer. A bare transcript/pane-log mtime BUMP is
+  // NOT proof the session took THIS message: a receiver in an active turn advances both mtimes with
+  // its OWN rendering even when our paste was swallowed at the turn boundary (incident 2026-06-23:
+  // ok=true, message gone). The ONLY proof is a NEW transcript record CARRYING our envelope —
+  //   claude: a queue-operation `content` (busy → enqueued) or the user-turn message (idle),
+  //   codex:  a user-input response_item (written at model-turn-start, ~4-6s — hence the codex grace).
+  // The receiver's own assistant/tool turn never reproduces the `<iap from-personality=…>` wrapper, so
+  // it cannot forge a confirm. No such record within the grace → false-FAIL (the sender retries) — NOT
+  // a false-OK (silent loss the contract forbids).
+  const confirm = seam.confirmLanded ?? ((payload: string) => transcriptCarriesEnvelope(baseline, payload))
+  const sleep = seam.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)))
+  const graceMs = confirmGraceMs(target.runtime)
   const graceDeadline = monotonicMs() + graceMs
-  do {
-    if ((mtimeOf(cwd) ?? 0) > baseline) return ok(undefined)
-    if ((paneMtimeOf(target.address) ?? 0) > paneBaseline) return ok(undefined)
-    sleepSync(LIVENESS_POLL_MS)
-  } while (monotonicMs() < graceDeadline)
+  while (true) {
+    if (confirm(envelope)) return ok(undefined)
+    if (monotonicMs() >= graceDeadline) break
+    await sleep(LIVENESS_POLL_MS)
+  }
   return err(
     `hosted peer "${target.personality}" (${target.runtime}) is listed live but did not accept the message ` +
-      `(no transcript or pane-log advance within ${graceMs}ms) — live but unresponsive to this delivery (not dead); message NOT delivered`,
+      `(no transcript record carrying the message within ${graceMs}ms) — live but unresponsive to this delivery (not dead); message NOT delivered`,
   )
 }
 
 /** Pane-log (TUI render-stream) mtime for a process address, or null when absent/unreadable.
  *  The pane-log is the canonical `<root>/logs/lifecycle/<address>.log` the supervisor appends raw
- *  pty bytes to (§1 contract). Used as the SECOND landed-confirm proxy in deliverViaHost. */
+ *  pty bytes to (§1 contract). Used by `resolveLiveRuntime` (freshest-pane-log among alive sessions).
+ *  NB: deliberately NOT used to confirm delivery — a pane-log mtime bump is not message-specific (the
+ *  receiver's own turn bumps it too), which was exactly the false-OK class deliverViaHost now avoids. */
 function defaultPaneLogMtime(address: string): number | null {
   try {
     return statSync(join(resolveGlobalRoot(), 'logs', 'lifecycle', `${address}.log`)).mtimeMs
@@ -492,6 +486,65 @@ export function compactTranscriptHasDone(
   return false
 }
 
+/** Deep-search every string value of a parsed JSON record for `needle` (CR-stripped on the haystack
+ *  side; the needle is pre-stripped by the caller). */
+function jsonStringValuesContain(value: unknown, needle: string): boolean {
+  if (typeof value === 'string') return value.replace(/\r/g, '').includes(needle)
+  if (Array.isArray(value)) return value.some(v => jsonStringValuesContain(v, needle))
+  if (value && typeof value === 'object') return Object.values(value).some(v => jsonStringValuesContain(v, needle))
+  return false
+}
+
+/**
+ * Did a NEW transcript/session-jsonl record CARRYING `envelope` appear since `baseline` (the
+ * per-runtime absolute file paths + SIZES captured immediately before delivery)? This is the
+ * MESSAGE-SPECIFIC landed-confirm `deliverViaHost` uses to kill the false-OK class — a bare mtime
+ * advance from the receiver's OWN turn is NOT a confirm; only a record echoing our envelope is.
+ *
+ * Reads ONLY the bytes appended past each baseline offset, JSON-parses each new jsonl line, and
+ * deep-searches its string values for the envelope (CR-normalized on both sides — a stored line may
+ * carry CR the envelope never had; CR is never semantically meaningful inside an IAP envelope). A
+ * match means the SESSION recorded our injection:
+ *   claude — busy: a `queue-operation` whose `content` is the pasted envelope verbatim; idle: the
+ *            user-turn message.
+ *   codex  — a user-input `response_item` (written at model-turn-start).
+ * The receiver's own assistant/tool records never reproduce the `<iap from-personality=…>` wrapper, so
+ * the full envelope is UNFORGEABLE by a concurrent turn — no false-OK. Because only bytes PAST the
+ * baseline offset are read, a pre-existing copy of an identical earlier message cannot pass either.
+ *
+ * Iterates the baseline file LIST verbatim — it does NOT re-scan the runtime's session dir each poll
+ * (unlike the minutes-long compact-done gate). A delivery's confirm window is seconds, so a brand-new
+ * session file appearing mid-delivery (a resume mid-flight) is negligible, and missing it fails in the
+ * SAFE direction (false-FAIL → the sender retries, never a silent loss). For codex this also avoids a
+ * full recursive `~/.codex/sessions` re-scan on every ~100ms poll (the active session file is already
+ * in the baseline), keeping the hot delivery path cheap.
+ */
+export function transcriptCarriesEnvelope(baseline: CompactDoneBaseline, envelope: string): boolean {
+  const needle = envelope.replace(/\r/g, '')
+  if (!needle) return false
+  for (const { path, size: offset } of baseline.files) {
+    let buf: Buffer
+    try {
+      buf = readFileSync(path)
+    } catch {
+      continue
+    }
+    const start = Math.min(Math.max(0, offset), buf.length)
+    const tail = buf.subarray(start).toString('utf8')
+    for (const line of tail.split(/\r?\n/)) {
+      if (!line.trim()) continue
+      let obj: unknown
+      try {
+        obj = JSON.parse(line)
+      } catch {
+        continue
+      }
+      if (jsonStringValuesContain(obj, needle)) return true
+    }
+  }
+  return false
+}
+
 function compactDoneTimeoutMs(env: NodeJS.ProcessEnv | undefined): number {
   const raw = env?.IAPEER_COMPACT_DONE_TIMEOUT_MS
   const n = raw === undefined ? NaN : Number(raw)